{"id":"ASB-A-508702364", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-03T17:44:55.642301420Z", "aliases":["CVE-2026-89774", "A-508702364"], "details":"In multiple functions of sco.c, there is a possible use-after-free due to a race condition. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-11-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/315636ba7cbf03382cfa7bd8887118f59fe96c5f", "https://android.googlesource.com/kernel/common/+/598dbca6a3f78f038650c434935c86d8c3a6edfb", "https://android.googlesource.com/kernel/common/+/84728e305ff666fc2bf2be382b422b51912d7b1c", "https://android.googlesource.com/kernel/common/+/a377ba61de42bb336732bd273330fcbfd3d51f3a"], "severity":"Critical", "spl":"2026-11-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["273364551645338130697825508727241130297", "275908178875978117776352226865614959846", "293763659914679669206540731570329294576", "157976387003120787858427734019012359638", "16923051719742114461656602309514615766", "139491148476820057207780320113663748263", "290464195320875838348115235392778370203", "210330632548212883944608933081380284154", "149738300467627174037688796449593648879", "163860092760068168527973404496330574299", "117652904510319141525138768182563033961", "311573751295308132078103560150549670592", "90782519114656288674661256744102693445", "230744974639091283630199179283443179404", "1758954352448707785300830385368890571", "257378971991063428663598234511197412995", "255842230632903779588210061712097146888", "96487420358020009315788618222781474038", "71623675858635082092189388405736378796", "295223522198145799127549827488787723513", "67417721803691219438397107276495800094", "256145075084012526286231653295815039809", "245609480039668376167631402016154579609", "46314266466018278230280954785230977585"], "threshold":0.9}, "id":"ASB-A-508702364-1edeb818", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/a377ba61de42bb336732bd273330fcbfd3d51f3a", "target":{"file":"net/bluetooth/sco.c"}}, {"deprecated":false, "digest":{"function_hash":"98532195768334665285801633892327255544", "length":1024}, "id":"ASB-A-508702364-c8f953a5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/598dbca6a3f78f038650c434935c86d8c3a6edfb", "target":{"file":"net/bluetooth/sco.c", "function":"sco_conn_ready"}}, {"deprecated":false, "digest":{"function_hash":"98532195768334665285801633892327255544", "length":1024}, "id":"ASB-A-508702364-d9ff4b43", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/a377ba61de42bb336732bd273330fcbfd3d51f3a", "target":{"file":"net/bluetooth/sco.c", "function":"sco_conn_ready"}}, {"deprecated":false, "digest":{"line_hashes":["273364551645338130697825508727241130297", "275908178875978117776352226865614959846", "293763659914679669206540731570329294576", "157976387003120787858427734019012359638", "16923051719742114461656602309514615766", "139491148476820057207780320113663748263", "290464195320875838348115235392778370203", "210330632548212883944608933081380284154", "149738300467627174037688796449593648879", "163860092760068168527973404496330574299", "117652904510319141525138768182563033961", "311573751295308132078103560150549670592", "90782519114656288674661256744102693445", "230744974639091283630199179283443179404", "1758954352448707785300830385368890571", "257378971991063428663598234511197412995", "255842230632903779588210061712097146888", "96487420358020009315788618222781474038", "71623675858635082092189388405736378796", "295223522198145799127549827488787723513", "67417721803691219438397107276495800094", "256145075084012526286231653295815039809", "245609480039668376167631402016154579609", "46314266466018278230280954785230977585"], "threshold":0.9}, "id":"ASB-A-508702364-e29745be", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/598dbca6a3f78f038650c434935c86d8c3a6edfb", "target":{"file":"net/bluetooth/sco.c"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/315636ba7cbf03382cfa7bd8887118f59fe96c5f"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/598dbca6a3f78f038650c434935c86d8c3a6edfb"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/84728e305ff666fc2bf2be382b422b51912d7b1c"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/a377ba61de42bb336732bd273330fcbfd3d51f3a"}]}